Ashish Kunwar

**Name of the Vulnerable Software and Affected Versions** MeshCentral version 1.1.21 **Description** A cross-site WebSocket hijacking protection bypass occurs when self-signed certificates are used. This is caused by an unconditional early return in the `CheckWebServerOriginName()` function within `webserver.js`. Unauthenticated remote attackers can establish cross-origin WebSocket connections to any of the twelve WebSocket endpoints and send crafted action commands to exfiltrate the server `sessionKey` used to sign session cookies. This allows attackers to forge session tokens as arbitrary users and gain full remote control of all managed devices. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** spice-vdagent (affected versions not specified) **Description** A path traversal flaw exists in spice-vdagent, where a path traversal is a vulnerability that allows an attacker to access files and directories that are stored outside the web root folder. This issue occurs because the filename provided by the SPICE host during file transfers is not properly sanitized. Consequently, a malicious or compromised SPICE host can write arbitrary files to any location on the guest operating system using the privileges of the spice-vdagent process, which typically corresponds to the logged-in user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** spice-vdagent (affected versions not specified) **Description** A flaw exists where a malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This leads to a heap buffer overflow within the `udscs write()` function, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. Exploitation requires the SPICE host to be untrusted or compromised. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SQLite versions prior to 3.53.2 **Description** A heap-based buffer overflow exists in the FTS5 full-text search extension. An attacker can cause a crash or execute arbitrary code by providing a crafted database containing malicious continuation page metadata with a `szLeaf` value smaller than 4. This triggers an integer underflow in the `fts5ChunkIterate()` function, resulting in an inflated remaining byte count during FTS5 MATCH query processing. This issue affects applications compiled with `SQLITE ENABLE FTS5`. **Recommendations** Update to version 3.53.2 or later.

**Name of the Vulnerable Software and Affected Versions** SQLite versions prior to 3.53.2 **Description** Memory corruption issues exist in the FTS5 full-text search extension. An attacker can cause process crashes, memory exhaustion, or arbitrary code execution by providing a crafted database containing malformed FTS5 page data. This is exploitable when an FTS5 MATCH query is executed against the malicious database. Technical details include an out-of-bounds read in the `fts5LeafSeek()` function via an attacker-controlled loop bound, and a heap buffer overflow write in the `fts5ChunkIterate()` function caused by an integer underflow through a crafted continuation page. **Recommendations** Update to version 3.53.2 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 18.7.9 iOS versions prior to 26.5 iPadOS versions prior to 18.7.9 iPadOS versions prior to 26.5 macOS Sequoia versions prior to 15.7.7 macOS Sonoma versions prior to 14.8.7 macOS Tahoe versions prior to 26.5 tvOS versions prior to 26.5 visionOS versions prior to 26.5 watchOS versions prior to 26.5 **Description** A use-after-free race condition exists in the IOKit framework, specifically within the IOTimeSyncFamily kernel extension and the `IOTimeSyncClockManager` component. A use-after-free is a memory corruption issue that occurs when an application continues to use a pointer after the memory it points to has been freed. This flaw may allow an app to cause unexpected system termination. **Recommendations** Update iOS to version 18.7.9 or 26.5 Update iPadOS to version 18.7.9 or 26.5 Update macOS Sequoia to version 15.7.7 Update macOS Sonoma to version 14.8.7 Update macOS Tahoe to version 26.5 Update tvOS to version 26.5 Update visionOS to version 26.5 Update watchOS to version 26.5

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server (affected versions not specified) **Description** The issue is related to errors in the representation of information by the user interface, allowing a remote attacker to conduct spoofing attacks. This can affect the system, enabling attackers to exploit the vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.